News for hackers. Stuff that matters.
Re:Signal Desktop is corrupting its database by capableweb on Sunday February 28, 2021 @08:34AM (#26293295)
Is it maybe possible that different people have different attack vectors they need to consider and backups are usually a weak-point for some of those people?

I understand it's frustrating when a (open source, forkable) application doesn't work the way you want it to, but you have to be able to see it from the other side as well.

Signal is signalling that chats are ephemeral and treating them as something else introduces security and privacy issues _in the way they are thinking about it_. It's very possible that's not an issue for you, but that doesn't make Signal wrong, is just make the two of you misaligned on why Signal exists. Signal is not for everyone and I think the team themselves make that pretty clear. Signal is for private and secure communications, and make no compromises that would lower either the privacy or the security, they rather compromise on other ends.

These kind of comments show the entitled parts of the internet, where open source software HAS to work a particular way otherwise ITS BROKEN AND HORRIBLE.

There are tradeoffs to everything. In this case, Signal made tradeoffs that you feel are wrong. You have a couple of choices, none of them include screaming that Signal should change their priorities based on your opionion: 1) continue using it anyways, start treating chats as ephemeral, 2) try to fork Signal and show us you can do it better or 3) dump Signal for a messenger that works the way you want it to.

In the end, there are multiple chat apps, use the right app for the right use case. Signal is definitely not a app for one-size-fits-them-all and it's pretty clear they are not trying to either.

Re:Signal Desktop is corrupting its database by satysin on Sunday February 28, 2021 @08:58AM (#26293449)
> Is it maybe possible that different people have different attack vectors they need to consider and backups are usually a weak-point for some of those people?

If backups are a weak point/risk don't enable the backups then? How is denying it for all a good solution?

> Signal is not for everyone and I think the team themselves make that pretty clear.

If Signal don't want to be a WhatsApp competitor they need to stop acting like one and jumping on every opportunity to point out how they are not Facebook/are better than WhatsApp.

All I have seen from Signal on social media for the past month is how they are the perfect alternative to WhatsApp.

Signal has disappearing messages so if a sender doesn't want their messages captured in a backup they can easily get that. Of course that doesn't stop the recipient exporting that one message or even just taking a screenshot so it isn't perfect but better than nothing.

> These kind of comments show the entitled parts of the internet

Comments like this piss me off. It is not "entitled" to want to protect my data. I have been telling people to protect their data for the twenty years I have worked in IT. But now for chat conversations apparently backups are pointless and we shouldn't be doing them??? Come on. This flies in the face of literally two plus decades of the tech community pushing for "normal people" to do backups!

Re:Signal Desktop is corrupting its database by capableweb on Sunday February 28, 2021 @09:16AM (#26293546)
> If backups are a weak point/risk don't enable the backups then? How is denying it for all a good solution?

Why enable something that could introduce additional security risks when it's both cheaper and safer not to develop that feature in the first place?

> All I have seen from Signal on social media for the past month is how they are the perfect alternative to WhatsApp.

Huh, I've not gotten that vibe at all after speaking with some of the people at Signal. They know that their product is not for absolutely everyone and quick glance at their Twitter doesn't seem to paint the picture you're seeing either. You have any specific examples you could point me to?

> It is not "entitled" to want to protect my data

Of course not and that was also not my point... The entitlement comes from you declaring that Signal is wrong here while not actually understanding the other perspective that they are operating from (which is different from yours, obviously).

> But now for chat conversations apparently backups are pointless and we shouldn't be doing them???

Again, if you are subscribing to the same worldview as the team of Signal is subscribed to, then yes, you shouldn't backup your ephemeral chat conversations. If you're instead interested in persisting your conversations, Telegram/Whatsapp/whatever probably fits your use case better and you feel free to use those instead.

Either you use a chat application that makes absolutely zero compromises on security and privacy but might have worse UX, or you chose a chat application that does compromise on those things but have a better UI. Your entitlement is that you think you can change Signals whole mission because you actually should be using a different chat application.

Re:Signal Desktop is corrupting its database by satysin on Sunday February 28, 2021 @10:05AM (#26293856)
> Huh, I've not gotten that vibe at all after speaking with some of the people at Signal. They know that their product is not for absolutely everyone and quick glance at their Twitter doesn't seem to paint the picture you're seeing either. You have any specific examples you could point me to?

https://i.imgur.com/bdUhqth.png

https://twitter.com/signalapp/status/1358903379515199488

Literally the first thing on their Twitter feed!

Sorry but if you are unable to see that Signal are clearly trying to position themselves as a WhatsApp alternative there is no point in continuing this conversation.

Re:Signal Desktop is corrupting its database by ximeng on Sunday February 28, 2021 @09:29AM (#26293609)
If Signal want maximum security / privacy, why not just make all messages auto-delete after a week (rather than their current stance that you lose them when you decide to use Android when you're currently using iPhone or if you lose your phone)?

4/5 of their last few tweets all seem to be pitching themselves as an alternative to WhatsApp / Facebook / targeted advertising? Realistically though their current position is you have to choose privacy or backups.

"We believe in targeted admirizing, not targeted advertising. Happy Valentine's Day from all of us at Signal."

"We've discovered that @tecnomobile devices (some of the most popular phones in Africa) enable notifications for @Facebook apps like @WhatsApp, but block Signal notifications by default. Privacy should be the default."

"Facebook, Instagram, and WhatsApp trying to collect your data when you're on Signal" (confused guy gif)

"If you see the shadow of looming advertisements in your current messaging app, make an early Spring to something better."

"January just ended, but if one of your New Year's Resolutions was to break up with Facebook there is still plenty of time."

Re:Signal Desktop is corrupting its database by admax88q on Sunday February 28, 2021 @10:43AM (#26294128)
What exactly is the sevurity compromise by allowong backups?
Re:Signal Desktop is corrupting its database by ximeng on Sunday February 28, 2021 @08:43AM (#26293356)
Realistically none of these are very good options. Starting a competitive messenger application is likely to be impossible - Signal got to where it is thanks in large part to 50mn USD from Whatsapp's founder. The fact that it's very difficult means that there aren't a huge number of competitive choices, and none that are "Signal but you can access your data". So even though complaining is not a great option, it might be the most likely way to get what is wanted, whether by someone from Signal seeing the request and agreeing, or someone else seeing there is a market for this.

If you have a choice between Whatsapp (metadata not private, but has backup) versus Signal (metadata private but no backup), if you need backup (or anyone you communicate with does), you lose privacy because you're forced to use Whatsapp. Arguably because of Signal's refusal to "compromise" on privacy by allowing backups you have lost privacy anyway.

Re:Signal Desktop is corrupting its database by _underfl0w_ on Sunday February 28, 2021 @11:22AM (#26294403)
A better option may simply be to fork and add the additional features, not necessarily create a new client.
Re:Signal Desktop is corrupting its database by satysin on Sunday February 28, 2021 @12:55PM (#26295298)
This raises an interesting question.

Can one fork the Signal iOS app, add features then publish to the App Store while using Signals infrastructure?

Re:Signal Desktop is corrupting its database by pseudalopex on Sunday February 28, 2021 @01:03PM (#26295397)
They changed the license so you can publish forks. They're opposed to forks using Signal's infrastructure though.
Re:Signal Desktop is corrupting its database by saurik on Sunday February 28, 2021 @03:15PM (#26296630)
If you do this you would not get push notifications.